This gets done through the inherently flawed mechanism of merely checking the validity of the card that has been presented (or typed in).

FORBES: Tokenization And The Collapse Of The Credit Card Payment Model